Users of the automated arr torrent and usenet stack have been complaining about malicious fake releases on public trackers which hit before the content street date and contain esoteric archive files that can run a program upon unpacking for maybe the last month or so.
The files are automatically downloaded by the users software because they match the users profile for that movie or series.
The users are mad that the devs told them to stop using trackers that distribute malware rather than the devs agreeing to implement filtering.
The only reason old archive formats are being deployed in that attack is because most antimalware doesn’t pay attention to them. Almost every modern archive format can at least open a link when processed but even the software that the users os calls to perform the operation has some kind of interlink built in to prevent that from happening without user awareness.
So there are currently malware crews actively and successfully targeting piracy networks and software.
Many years ago, one vector for mp3s other than extension-fu was embedding clickable links in the id3 data so that when displayed in Winamps playlist a user would accidentally or inquisitively make contact with some server. I first encountered this on soulseek.
There are also circumstances where extension-fu isn’t required. You can test this out on your own system by making a copy of some standalone program and renaming it with a wrong extension (say, .mp3 for instance!) then trying to open it.
If you got a love for that cde/next step look there’s projects that do it.